CISSP Domain 1 study guide
What Security and Risk Management tests
Domain 1 is the governance foundation of the CISSP exam. It tests whether you can connect security decisions to business objectives, professional ethics, law, accountability, and acceptable risk. The strongest answer usually establishes authority, policy, and risk ownership before choosing a technical control.
The 12 Domain 1 objectives
Use the objectives as a coverage checklist. The exam combines them in scenarios, so study the relationships between governance, risk, people, and continuity instead of memorizing each heading in isolation.
Professional ethics
Apply the ISC2 Code of Ethics and organizational ethics when duties, pressure, or competing interests conflict.
Security concepts
Understand confidentiality, integrity, availability, authenticity, and nonrepudiation as business requirements.
Security governance
Align security with business objectives, define accountable roles, and apply control frameworks with due care and due diligence.
Legal and regulatory issues
Evaluate privacy, cybercrime, intellectual property, contracts, transborder data flow, and regulatory obligations.
Investigation types
Distinguish administrative, criminal, civil, regulatory, industry-standard, and electronic-discovery considerations.
Policy and requirements
Translate business needs into policies, standards, procedures, baselines, and security requirements.
Business continuity
Identify, analyze, and prioritize business continuity requirements before selecting recovery technology.
Personnel security
Manage screening, employment agreements, onboarding, transfers, termination, vendors, and insider risk.
Risk management
Identify, assess, treat, monitor, and communicate risk using qualitative and quantitative methods.
Threat modeling
Use repeatable methods to identify threats, attack paths, trust boundaries, and suitable mitigations.
Supply-chain risk
Assess and manage third-party, supplier, acquisition, minimum-security, and service-level risks.
Awareness and training
Build role-based programs and measure behavioral outcomes instead of completion activity alone.
Risk analysis and formulas
Start by identifying the asset, threat, vulnerability, likelihood, and impact. The business or asset owner—not the security practitioner—accepts residual risk. Security supplies analysis and treatment options so the accountable owner can make an informed decision.
Single Loss Expectancy (SLE)
Asset Value × Exposure Factor
Annualized Loss Expectancy (ALE)
SLE × Annual Rate of Occurrence
Safeguard value
ALE before − ALE after − annual control cost
Residual risk
Risk remaining after controls are applied
Exam trap
A positive calculation does not automatically authorize a control. Consider safety, law, contractual obligations, risk appetite, and management approval alongside cost-benefit analysis.
High-yield distinctions
Due care
Taking the reasonable actions expected to protect the organization.
Due diligence
Continuously investigating and verifying that those protections remain effective.
Risk appetite
The broad amount and type of risk an organization is willing to pursue or retain.
Risk tolerance
The acceptable variation around a specific objective or risk threshold.
Policy
Management direction: what must be achieved and why.
Standard
A mandatory, measurable rule that supports a policy.
Procedure
The step-by-step method used to perform a task.
Guideline
Recommended, nonmandatory advice for situations requiring judgment.
Manager mindset
Choose governance before implementation
When a scenario lacks direction, ownership, authorization, or scope, establish those first. When people may be harmed, protect life and safety. When evidence matters, preserve it and maintain chain of custody. When residual risk remains, communicate it to the authorized risk owner.
Worked Domain 1 scenario questions
These examples show the decision pattern the exam is testing. Try to answer before revealing the rationale in your own mind.
Question 1
A new CISO inherits dozens of security projects, but executives cannot explain which business risks they address. What should the CISO do FIRST?
Best answer: Map business objectives and material risks to security outcomes before prioritizing the portfolio.
Governance begins with business objectives, accountable ownership, and risk—not with a product or the newest control.
Question 2
An executive asks a security director to omit material facts from a required breach notification. What is the BEST response?
Best answer: Document the concern, escalate through legal and governance channels, and ensure required reporting remains accurate.
Management owns risk, but that ownership does not override professional ethics or legal reporting duties.
Question 3
Employees complete annual phishing training, but credential submissions do not decline. Which measure BEST evaluates effectiveness?
Best answer: Trends in reporting, repeat failures, and credential submission segmented by risk group.
CISSP questions distinguish activity metrics from evidence that behavior and risk have actually changed.
How to study CISSP Domain 1
Step 1: Learn the governance hierarchy: business objectives → policy → risk assessment → control selection → measurement.
Step 2: Build comparison cards for easily confused concepts such as due care vs. due diligence and policy vs. standard.
Step 3: Practice risk calculations, but always explain who owns the resulting decision and what nonfinancial constraints apply.
Step 4: Review every distractor. State why it is premature, too technical, unauthorized, unsafe, or inconsistent with the business objective.
Step 5: Finish with mixed scenarios that connect Domain 1 to assets, architecture, IAM, testing, operations, and software security.
For a deeper treatment of quantitative analysis and risk responses, continue to the CISSP risk management guide. Use this page as the complete Domain 1 map and that guide for the narrower risk-analysis topic.